CVE-2026-42522: Jenkins GitHub Branch Source Plugin - Missing Permissions Check Allows Unauthorized Connection Tests
Summary
CVE-2026-42522: Jenkins GitHub Branch Source Plugin versions 1967.vdea_d580c1a_b_a_ and earlier do not perform a permission check in a method implementing form validation. Affects org.jenkins-ci.plugins:github-branch-source versions < 1967.1969.v205fd594c821. Fixed in 1967.1969.v205fd594c821. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jenkins GitHub Branch Source Plugin is a widely used tool that integrates GitHub repositories with Jenkins, enabling automated builds and CI/CD workflows. It allows users to manage branches and pull requests from GitHub directly within Jenkins. However, certain versions of this plugin have a critical vulnerability that compromises security by allowing unauthorized users to perform connection tests to arbitrary URLs.
Vulnerability Detail
The vulnerability arises from the absence of a permissions check in a method responsible for form validation within the Jenkins GitHub Branch Source Plugin versions 1967.vdea_d580c1a_b_a_ and earlier. This flaw permits attackers who possess Overall/Read permission to connect to any URL of their choosing using GitHub App credentials they specify. The potential ramifications include unauthorized access to sensitive information and exploitation of the Jenkins environment, leading to further security breaches.
How To Fix
Latest published version: 1986.v801e40614d00 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1967.1969.v205fd594c821
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Jenkins instance to trusted users only, ensuring that only those with the necessary permissions can access the GitHub Branch Source Plugin functionalities. Additionally, monitor logs for any unauthorized connection attempts.
Conclusion
The Jenkins GitHub Branch Source Plugin has a significant vulnerability that allows unauthorized connection tests due to a missing permissions check. It is crucial for users to update to the patched version to mitigate potential security risks. Implementing temporary workarounds can help safeguard against exploitation until the update is applied.
See every vulnerability recorded for org.jenkins-ci.plugins:github-branch-source →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
Versions 1967.vdea_d580c1a_b_a_ and earlier are affected by this vulnerability.
An attacker needs Overall/Read permission to exploit this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing access restrictions and monitoring for unauthorized activities as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.jenkins-ci.plugins:github-branch-source.
